The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill initiates repository-wide authority grants (e.g., autonomous merge and operations) based on specific natural language triggers such as "merge all" or "authorize everything". This creates a vulnerability surface where instructions embedded in processed tickets, pull requests, or repository content could trick the agent into escalating its own permissions.
Ingestion points: The skill reads and processes ticket Markdown, repository folders, commit diffs, and user-provided text (SKILL.md).
Boundary markers: The instructions include explicit directives to ignore quoted text, examples, questions, and negations when evaluating authority grants (SKILL.md).
Capability inventory: The agent has access to tools that grant persistent repository authority (grant-repository-autonomous-merge, grant-repository-autonomous-operations), modify ticket status (change-status-ticket), and perform file edits (edit, write) (SKILL.md).
Sanitization: While the operating defaults mention preserving secret protection, there is no technical sanitization or verification mechanism for the trigger phrases extracted from untrusted Markdown or repository data (OPERATING-DEFAULTS.md).
[PRIVILEGE_ESCALATION]: The skill provides logic for the agent to acquire broad, repository-wide operational authority (grant-repository-autonomous-operations --scope current-and-future-runs). The impact of misinterpretation or prompt injection is high, as it enables the agent to perform destructive or external actions autonomously without further user confirmation.
[COMMAND_EXECUTION]: The skill's operating defaults define protocols for shell command execution, including environment resolution using shutil.which and os.name, and specific handling for PowerShell exit codes. While these are presented as best practices for cross-platform compatibility, they define the methodology for the agent to interact with the host system's shell (OPERATING-DEFAULTS.md).

ask-skills